One-to-one and groups
Text, photos and voice notes, on your own or with everybody. Mention someone and they'll hear about it even if they've muted the group, which is usually the point of mentioning them.
Messages
Chats, calls and groups, sealed on your phone.
The ordinary things you'd expect from a messenger, built so the server in the middle can't read any of it. No phone number to hand over, no ads, and a server you can run yourself if you'd rather not trust ours.
The everyday parts
What you'll actually use.
All of it encrypted, all of it on by default. There is no plain mode to accidentally end up in.
Saying something
Voice calls
Ring someone directly. The audio is encrypted between the two phones, and the check that you're talking to the right person rides inside the conversation you already trust.
Stories
Post a picture, a few words or a link, for as long as you choose, an hour, or a week. Only your contacts see it, and the server is never told how long it's meant to last.
Fix the typo
Change a message after you've sent it. It turns up on the other phone as the same message, marked edited, not as a second one nobody can tell apart from the first.
A reaction only they see
In a group, choose "Just to them" and the emoji goes to whoever wrote the message. Nobody else is sent it, so there is nothing sitting on their phones for anything to find later. The label reads "only you" on their phone and "only them" on yours.
React while they're talking
On a call, tap a reaction and it shows on the other screen for a moment, so you can agree without cutting across whoever is speaking. It travels inside the call's own encryption, and nothing about it is saved. When the call ends there is nothing left of it on either phone.
On your own time
Write now, send later
Say it while you're thinking of it and let it arrive at a decent hour. The message waits on your phone, not on the server, until it goes, there's nothing anywhere for anyone to hold.
Nudge yourself, quiet a thread
Ask to be reminded to reply, or put a conversation to sleep for the afternoon. Both are kept on your phone, the server has no idea a thread is snoozed, and no idea you meant to write back.
Chats that clear themselves
Set a conversation to tidy up after an hour, a day or a week. It applies to both phones, and the server isn't told a conversation is timed, let alone for how long.
Find what you said
Search across every conversation you have. It happens on your phone, because the server has never been able to read a word of it, which is also why nobody can search it but you.
Knowing it stays yours
No phone number
Sign up with a username. People find you by the name they already call you, and your number stays out of it entirely.
You'll know if a key changes
If someone's phone is replaced, or somebody tries to stand in for them, the app stops and says so before anything else is sent. You can compare safety numbers with them, or accept the new keys if you know why they changed. What you cannot do is send through it without choosing one.
Photos don't say where you were
Pictures you send from the photo button are rebuilt on the way out, so the coordinates your camera wrote in don't travel with them, in a chat, in a group, in a story. Video goes the same way, and today a video can be posted to a story rather than sent in a conversation. A picture sent as a file is rebuilt too, which it did not used to be. Anything that is not a picture goes exactly as it is, which is rather the point of a file, so check what's in it first.
Link previews, made at your end
When you share a link, your phone builds the little card, so the site never hears from the person you sent it to. It does hear from you, which is why there's a switch to turn it off.
Lock it behind your face
Your phone is the one place your messages are readable, so it's the one place worth locking. Face, fingerprint or your usual PIN, and how long it waits before asking again is yours to set, from straight away to a few minutes. It's there for the handset somebody picks up, not for anyone taking the storage apart.
Off the record
Turn a conversation off the record and neither phone writes it down. Close the app and it is gone: no file to hand over, nothing in the backup. It takes both phones agreeing, and yours keeps writing until theirs answers that it understood, so a conversation is never off the record on one side and on disk on the other. It cannot stop a screenshot.
A poll nobody can attribute
Ask a group something and no vote is sent to anybody, not to the server and not to you as the person asking. Each vote is split into random pieces, one per member, and everybody publishes only the sum of the pieces they were handed; adding those sums gives the counts. Everyone has to vote before there is a result, because a missing one leaves a random number in the total rather than a smaller count. Everyone other than the voter would have to work together to know how one person voted, and in a group of two that is nobody, so the word anonymous is not offered for a pair.
Carry a call to another device
On a call on your phone, pick it up on the tablet and keep talking. The other person hears a short gap, never leaves their call screen, and gets one call in their log rather than two. They are never hung up on at any point, and if no device takes it the call stays exactly where it was.
Where it lives
Your name is yours, not the server's.
Your address comes from your passphrase rather than from whoever's hosting you. So you can keep a mailbox on more than one server, and if one of them disappears you've lost a mailbox, not your identity, and not the people who know how to reach you.
Servers can pass messages to each other too, so you and the person you're writing to don't have to be on the same one. That's worth knowing both ways round: it means more choice, and it also means one more server has seen that a message went by. We'd rather set that out than let you discover it.